CVE-2026-62675: Omnigent authenticated remote code execution via Python callable tools

CVE-2026-62675 · Severity: high · CVSS 8.8 · Published 2026-08-21

Omnigent is an AI agent framework that allows users to upload custom agent configurations. An authenticated user can upload a malicious configuration that invokes dangerous Python functions (like subprocess.check_output) on the server's runner environment, leading to arbitrary command execution. In hosted multi-user deployments, this allows a normal user to execute code with runner privileges, potentially exposing credentials, workspace data, and internal services.

Technologies: omnigent (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-62675 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62675 being exploited in the wild.
How severe is CVE-2026-62675?
High severity, with a CVSS score of 8.8, published 21 August 2026.
Which products and versions are affected?
omnigent (PyPI) < 0.3.0, ECOSYSTEM:introduced=0,fixed=0.3.0.
Is there a fix for CVE-2026-62675?
Yes. omnigent (PyPI): upgrade to 0.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62675 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62675?
Check whether you run omnigent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • omnigent (PyPI): upgrade to 0.3.0 or later
    pip install "omnigent>=0.3.0"

Technical details

This is a code injection vulnerability (CWE-94) in Omnigent's agent bundle validation. The vulnerability occurs in the trust boundary between uploaded user bundles and trusted operator features. The server's validate_agent_bundle() function disables environment expansion and can enforce policy-handler allowlists, but it does not reject tools.<name>.callable entries. Later, _resolve_spec_callable() uses importlib.import_module() to dynamically import and execute the callable at the dotted path specified by the user, such as subprocess.check_output. An authenticated user can exploit this by uploading a crafted bundle via POST /v1/sessions with a tool callable pointing to any importable Python function. No user interaction or special privileges are required beyond initial authentication. The fix was to reject callable: tool paths for tenant-uploaded bundles unless explicitly allowlisted by the operator.

Affected products

  • omnigent-ai omnigent < 0.3.0

Identifiers

  • CVE-2026-62675
  • GHSA-756x-9hf6-q4h4
  • PYSEC-2026-3872

Timeline

  • 2026-06-29: disclosed
  • 2026-09-02: patched: Version 0.3.0 released with fix
  • 2026-09-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.